Maike13

Thanks for the reply. That did the trick.

I'm trying to use the Cycle Input Focus Plus KeePass browser plugin for Firefox to move the field focus on a web page to the username field. The default key sequence to do this is Ctrl-Alt-U and this works perfectly when i do it manually. I'm trying to get Auto-Type to enter this but failing miserably. I tried ^%U but it doesn't work. What am I doing wrong?

Thanks wellread1. All this has been most interesting.

Hi wellread1. So, if I undrstand correctly, the OTP codes don't really give the protection I was imagining. I was thinking someone would need acces to both my computer and my phone to hack the master password and obtain the OTP keys, but from what you're saying they can by-pass the OTP keys by hacking the Generator Token Secret Key from the dbname.otp.xml file. Am I following this correctly?

Thanks Paul. There's a Recovery Mode available where you can enter your Generator Token Secret Key to open the database, instead of entering the OTP codes. This is the same key you use to originally set up HOTP. You also still need to know and enter your Master Password.

Hi Paul. I'm not relying on another app, as I'm also using a strong password. The OTP codes generated by the other app (which runs on my iPhone) adds a second layer of security. So to open the KeyPass database, I need someting I know (my password) and something I possess (my iPhone).

You're right. Not sure what I was doing before, but I tried it again and the dbname.otp.xml file syncs with the Authenticator if the OTPs open the database. Before opening, the counter in my dbname.otp.xml file read 65 and the counter in the Authenticator read 72 and I used OTPs 72, 73, & 74. After successfully opening the database, using three OTPs, the counter in my dbname.otp.xml file reads 75 and the counter in the Authenticator reads 74. I think the one difference is because KeePass is showing...

Interesting. I tested this out. The counter values in the dbname.otp.xml file and the Authenticator match as long as every attempt to open the database is successful. However if you retrieve and enter OTAs and fail to open the database (perhaps midtype an OTA), the Authenticator counter value will increase, while the value in the dbname.otp.xml file will not. These values do not sync on the next successfull attempt to open the database, The Authenticator values always increase each time you retrieve...